SEC_CLAUSES.rtf

2001.00 Preservation, Packaging, Packing and Marking (Mar 2009)

Preservation, packaging, packing, and marking of all deliverable contract line items must conform to normal commercial packing standards to assure safe delivery at destination.

2002.00 Marking (Mar 2009)

All information submitted to the Contracting Officer, the POC, or his/her designated contact shall clearly indicate the number of the contract for which the information is being submitted.

2003.00 Additional Shipping Instructions (Mar 2009)

The contractor shall include the SEC contract/delivery order number on all packing slips that accompany items shipped to the SEC.

3001.01 Inspection and Acceptance by the Contracting Officer's Representative (COR) (Aug 2013)

Inspection and Acceptance of supplies and/or services to be furnished under this contract will be performed by the Contracting Officer's Representative (COR) – William Roberts. Inspection and Acceptance will be performed at the Securities and Exchange Commission, 100 F St. NE, Washington, DC 20549.

4003.00 Place of Delivery- FOB Destination (Jun 2013)

The deliverables to be furnished under this contract shall be delivered to the following address:

U.S. Securities and Exchange Commission 100 F St. Ne Washington, DC 20549 Attn: William Roberts Phone Number: 202.551.7316

E-mail: RobertsW@SEC.GOV

Status Reports:

The contractor shall submit a monthly status report, via email, of all work performed under this contract by the 15th of each month. The progress report shall contain the following information:

All reports and correspondence, except as otherwise specified, shall be directed to the SEC points of contact identified in this contract.

4004.00 Documenting, Inspecting, and Accepting Contract Deliverables (Jun 2011)

The contractor shall submit all deliverables requiring a transmittal sheet with either the attached Deliverable Transmittal sheet or an alternative transmittal sheet that contains substantially the same information.

5001.00 Contract Administration (Dec 2011)

This contract will be administered by the SEC's Office of Acquisitions. All inquiries should be directed to the following address:

Securities and Exchange Commission Office of Acquisitions Attn: Paul LaFranchise Email: lafranchisep@sec.gov

RM 4222

100 F Street, NE Washington, DC 20549

5001.03 Contract Administration for Non-Severable Services (Aug 2013)

The services for the contract are considered non-severable services. Non-severable services are considered to be new tasks, each with details of the task and when it is due.

a. The task is described by SEC employees and e-mailed to the Contracting Officer’s Representative (COR).

b. COR ensures it is in scope and e-mails it to the vendor Project Manager (PM).

c. Vendor PM reviews it and assigns the task to the contractor personnel (CP).

d. SEC employees work with the assigned CP.

The COR will review deliverables within the time frames indicated in approved technical direction letter / e-mail.

5003.00 Submission of Invoices (Apr 2012)

The Securities and Exchange Commission accepts only electronic/e-mail invoices.

Invoices shall be submitted on a monthly basis.

Contractors should submit invoices in accordance with the SEC Prompt Payment Provision of the contract. Contractors are cautioned against submitting an invoice prior to goods and services being received/accepted. Invoices submitted prematurely may be rejected.

Electronic/e-mail Invoice Instructions:

Invoices must be in PDF Format and may not exceed 10MB Subject Line: Company name and the invoice number e-mail Message:

For supplies: contract line item number, item description, quantity delivered, and unit and extended price, per Section B CLIN structure

For services: contract line item number, item description, period of performance and associated costs, per Section B, contract line item, CLIN, structure

Shipping and handling charges, if applicable

Clearly mark duplicates of previous invoice submissions with "DUPLICATE"

Clearly mark the final invoice with "FINAL INVOICE"

Attach the invoice and any supporting documents in a secure tamper-proof or tamper-resistant format compatible with Adobe Acrobat.

Electronic signatures are acceptable in scanned documents. Each page of a document must be clearly marked with information identifying it with the company, the contract, the invoice, and any other information required by the contract.

E-mail invoices to the following address: 9-AMC-AMZ-SEC-Invoices@faa.gov

5003.02 Software license Maintenance and Subscription Service Invoicing (Mar 2009)

It is customary commercial practice to pay for software licenses maintenance at the beginning of the contract period of performance, after submittal of a proper invoice. All CLINS that include software may be invoiced at the beginning of the month of service.

5004.00 Appointment of Contracting Officer's Representative (COR) (Nov 2012)

a. William Roberts, is hereby designated the Securities and Exchange Commission COR and Denise Clark the Alternate COR for administration and information relating to this contract.

b. The Contracting Officer (CO) shall appoint, in writing, a Contracting Officer's Representative (COR) and, if possible, an Alternate COR for this award. The COR and Alternate COR shall have a current Federal Acquisition Certification for CORs (FAC-COR) at the appropriate certification level for the contract. A COR may serve on a contract requiring certification at or below his/her level, but not on one requiring a higher level. The CO shall provide the Contractor with a copy of the COR appointment letter(s). The COR may not re-delegate his or her authority; only the CO has this authority.

c. The COR will manage the contract in coordination with the CO and within the terms of the contract and the boundaries of a COR's duties as outlined in the document "Instructions for CORs and Their Supervisors." The COR's responsibilities include reviewing invoices and charges by the Contractor and informing the CO of areas where exceptions are taken. If this is an award for services and contractor personnel are brought on-site to SEC facilities, the COR must adhere to SECR 10-24.

d. Only the Contracting Officer has the authority to change the terms and conditions of this contract. The COR may request a contract modification, but the CO will make the final determination. The COR may not agree to or issue a change to the contract terms and conditions. In the event the Contractor effects changes to the contract at the direction of any person other than the CO, the changes will be considered to have been made without any authority and no adjustments will be made to the contract.

5007.00 Payment Information (Feb 2012)

Payment will be made to small business contractors within 15 days of receipt of a valid invoice.

Unless otherwise stated, and the contractor is not a small business, payment will be made within the guidelines of the Prompt Payment Act and requires that payment is made within 30 days from receipt of a valid invoice.

6001.00 SEC Non-Disclosure Requirements and Agreements (Jul 2012)

1. The attached non-disclosure agreements (NDAs) are required and must be completed, signed, and returned to the Contracting Officer before starting performance under this contract.

2. The provisions of 17 C.F.R. § 200.735-3(b)(1) & (b)(2) expressly prohibit unauthorized disclosure and improper use of confidential or non-public information or documents. The Contractor, and its employees, agents, subcontractors, and subcontractor personnel who may have access to confidential or non-public information or documents in the performance of this contract, agree to be bound by the provisions of 17 C.F.R. § 200.735-3(b)(1) & (b)(2) and the terms set forth in the attached NDAs.

3. The SEC updates these agreements periodically and the most recent version supersedes all previous versions on new contracts or modifications to existing contracts. The SEC may incorporate the revised NDAs by a unilateral modification.

4. An officer or executive authorized to bind the company shall execute the NDA for the Contractor on behalf of the company and return it to the Contracting Officer prior to the Contractor commencing work on the contract. The Contractor shall submit to the Contracting Officer a list of its employees, agents, and subcontractors that will be authorized access to SEC information by virtue of performing the requirements set forth in this contract. Each person identified on the list shall then sign the employee NDA on behalf of himself or herself and submit it to the Contracting Officer before commencing work on the contract.

5. The Contractor shall also ensure that all of its employees, agents, and subcontractors assigned to perform the requirements set forth in this contract adhere to the terms of the non-disclosure agreement, including protecting from unauthorized disclosure all confidential or non-public information. Failure to adhere to this clause or the terms of the NDAs, including assignment of staff to this contract who have not executed required NDAs, shall result in action by the Contracting Officer, as deemed appropriate. Violation of this clause or the attached NDAs by the Contractor, its employees, agents, subcontractors, or subcontractor personnel may result in default of the contract and/or liability to the Government for any and all rights and remedies provided by law.

6001.01 Restrictions on Use, Disclosure, and Duplication of Confidential and Non-Public Information (Nov 2010)

Confidential or non-public information, for purposes of this clause includes but is not limited to, all financial, statistical, personnel and/or technical data which is furnished, produced, generated, or otherwise available to the Contractor, during the performance of this contract. Unless otherwise specified, confidential or non-public information shall not be used for purposes other than performance of work under this contract without the prior written consent of the Contracting Officer. The Contractor, and its employees, agents, subcontractors, and subcontractor personnel are restricted from duplicating or disclosing confidential or non-public information, in whole or in part, outside the Securities and Exchange Commission (SEC) for purposes other than fulfillment of the requirements set forth in this contract. Any presentation of any confidential or non-public information, or any reports or material derived from confidential or non-public information shall be subject to review of the Contracting Officer prior to publication or dissemination. Any questions about whether information is confidential or non-public shall be referred to the Contracting Officer prior to use disclosure or duplication.

(End of clause)

6002.00 Type of Contract (Mar 2009)

This is a Firm Fixed Price type contract.

6003.00 Representations and Certifications (Mar 2009)

The Contractor's completed Representations, Certifications, and Other Statements of Offerors or Respondents is incorporated herein by reference.

6006.00 Conflicts of Interest (Mar 2009)

(a) General. Subpart 9.5 of the Federal Acquisition Regulation 48 C.F.R. 9.5, prescribes responsibilities, general rules, and procedures for identifying, evaluating, and resolving organization conflicts of interest.

(b) Purpose. The purpose of this clause is to avoid, neutralize, or otherwise mitigate organizational conflicts of interest which might exist related to a Contractor’s performance of work required by this contract. Such conflicts may arise in situations including, but not limited to: a Contractor’s participation, as a Quoter or representative of a Quoter, in a procurement in which it has provided assistance in the preparation of the Government’s requirements and specifications; a Contractor’s providing advisory assistance to the Government in a procurement in which the Contractor’s firm or one which the Contractor represents is an actual or potential Quoter; and a Contractor’s participation, as a Quoter or representative of a Quoter, in a procurement where the Contractor has obtained confidential or proprietary information relating to competing Quoters as a result of the Contractor’s work on prior task orders.

(c) Definition. For purposes of this clause, the term ‘Contractor’ means: The Contractor; any of the Contractor’s parents, affiliates or other entities in which the Contractor or such parents or affiliates have a financial interest; successors in interest to the Contractor or any of its parents or affiliates; proposed consultants or subcontractors at any tier; and employees thereof.

(d) Restrictions. The Contractor agrees:

(1) To remain ineligible to participate in any capacity (including participating as a prime contractor, subcontractor, or as the representative of another party) in contracts, subcontracts, or quotes (whether solicited or unsolicited) that directly relate to the Contractor’s performance of work under this Contract.

(2) Prior to beginning work on a task order, to execute such Confidentiality Agreements, Statements of Non-Disclosure or other documents which the Contracting Officer may, in his/her sole discretion, require in order to protect the proprietary nature or confidentiality of information provided by the Government or otherwise received by the Contractor in connection with its work under this Contract.

(3) As otherwise provided in this Contract, not to accept any compensation or any other form of payment from a broker, potential lessor, or any source other than the Government for services rendered under this Contract, and to employ aggressive strategies to minimize the Government’s lease costs where the Contractor would entitled by common business practice to received a real estate commission or any form of payment from a broker, potential lessor, or other party, for work performed under this Contract.

(4) To immediately notify the Contracting Officer of any offer of compensation, other form of payment, or thing of value, made by a broker, potential lessor, or any source other than the Government to the Contractor related to services rendered under this Contract, regardless of whether such offer was made during Contractor’s performance of work under a given task order or subsequent to Contractor’s completion of work under such task order.

(5) Prior to the acceptance of a task order request, to immediately notify the Contracting Officer of any potential conflict of interest which would prevent or limit the Contractor’s ability to perform the work requested.

(6) To immediately notify the Contracting Officer of any conflict of interest discovered during Contractor’s performance of work pursuant to a Government issued task order; provided that the Contracting Officer shall have the right to impose such restrictions as he/she deems appropriate on Contractor’s performance based on the existence of such a conflict or, if the Contracting Officer determines that such restrictions would not adequately address the conflict of interest at issue, to terminate the Contractor’s performance of work under the task order at no cost to the Government.

(7) As otherwise provided in this Contract, that if the Contractor declines to accept a task order request and subsequently participates (either directly or as a representative of another party) in a Government contracting action that was the subject of the task order request, then the fee which the Contractor would have been entitled to receive for such task order work or the fee actually paid by the Government for the task order’s performance by another contractor, whichever is greater, shall be applied toward the Contractor’s minimum ordering guarantee.

(8) That in the event that Contractor knowingly withholds the existence of a conflict of interest from the Government, that the Contracting Officer may terminate this Contract at no cost to the Government and any minimum guarantee(s) otherwise applicable to the Contractor will be forfeited; provided, that the foregoing shall be in addition to all other remedies and causes of action which the Government may have against the Contractor, including the suspension and/or debarment of the Contractor.

(9) To include this Conflict of Interest clause, including this subparagraph, in all of the Contractor’s subcontracts at all tiers (appropriately modified to preserve the Government’s rights hereunder) which involve the performance of work by subcontractors in support of this Contract.

(10) That, in addition to the remedies enumerated above, the Government may terminate this Contract for cause in the event of the Contractor’s breach of any of the above restrictions.

(e) The prohibition against performing work that ‘directly relate(s) to the Contractor’s performance of work under this Contract’ refers only to work involving the evaluation, assessment, and development of specifications for the automated procurement system provided by Fillin 1: [ insert vendor’s/contractor’s name here] [To Be Determined] Specifically, the fact that an agency procurement is performed using the automated procurement system shall not be used as a basis for excluding Fillin 2: [ insert vendor’s/contractor’s name here] (or any Fillin 3: [ insert vendor’s/contractor’s name here] -related entity or affiliate) from participation in the procurement.

6007.00 Compliance with Regulations (Mar 2009)

The Contractor shall comply with all statutes, regulations, directives, instructions, and references applicable to the conduct of this acquisition as imposed by the Federal Government and the SEC, including, without limitation, those specified or referred to in this contract.

The Contractor and its employees shall become acquainted with and shall comply with the rules and regulations of the SEC’s facilities, including, but not limited to security, controlled access, personnel clearances, and conduct with respect to health and safety at the site, regardless of whether or not title to the facility is vested in the SEC.

6010.01 Key Personnel (Mar 2009)

The Contractor shall designate specific senior level professional and managerial personnel as key personnel who are essential to the successful performance of work under this contract. Key personnel shall be available for full-time assignment as necessary to efficiently manage the work of the contract and shall be available on the effective date of award. Key personnel shall include the program manager, the POC (see 6010.03), a Subject Matter Expert (SME) in both the software and in contracting, and a system administrator if one is assigned to work at the SEC.

6010.03 Point of Contact (POC) (Mar 2012)

The Contractor shall designate a senior person from the key personnel specified in Section 6010.01 as the point of contact during normal business hours. The POC may be the Program Manager but the POC must have some contracting knowledge and be very experienced in the function and use of the software being implemented. This person shall be located on-site during normal business hours until the system is accepted. Should the person be unavailable when scheduled to be on-site, the Contractor shall notify the Contracting Officer’s Representative (COR) of the name of the designated replacement. The POC or designatee shall have the authority to direct personnel and shall be accountable to the directions of the COR. The Contractor shall provide to the COR a contact and backup contact who shall be on-call to make decisions as required during non-business hours.

6010.04 Contractor Responsibilities/Standards of Conduct (Jul 2013)

The Contractor shall furnish all managerial, supervisory, and personnel to successfully, effectively, and efficiently accomplish all work required by this contract. Contractor personnel are employees of the Contractor and under its administrative control and supervision. Contractor personnel are not employees of the Government.

The Contractor shall select, supervise and exercise control and direction over its employees under this contract. The SEC will not exercise any supervision over the Contractor's employees, but may, in coordination with Contractor management, provide sufficient direction to contractor personnel to ensure that the purposes of the contract are met and the government's interests are protected.

Contractor shall be responsible for:

- Approving time cards of its employees,

- Approving leave requests of its employees,

- Performing performance evaluations of its employees

- Making hiring and firing decisions for its employees.

- Informing its employees that they are not employees of the SEC and have not received an appointment in the federal service.

- Informing its employees that they are not to accept direction from employees of the SEC beyond that required to accomplish the purposes of the Contract.

- Informing its employees that deliverables must be marked with employer's logo or other marking legend (as appropriate to the deliverable) and it must be removable if the SEC elects to use the deliverable as SEC materials. This applies to reports, slides, and other documents called out in the contract as deliverables.

- Informing its employees that the Contractor is responsible for approval of their time cards, leave requests and performance evaluations, and for hiring and firing decisions.

- Directing their employees to identify themselves in their communications (and in their work product as appropriate) as contractors rather than SEC or Federal employees, and ensuring that they in fact do so.

- Directing their employees to display their distinguishing badges or other visible identification of their status as contractors at meetings with government or outside personnel.

- Considering during their performance of the contract whether any actions they are taking would limit the ability of an SEC employee to exercise discretion on an inherently governmental function and bring such actions to the attention of the COR.

The Contractor is accountable to the SEC for the actions of its personnel. The Contractor's employees, when on-site at SEC facilities under this contract, shall only engage in duties specified in the statement of work, task order or other work statement, and not in other business, or political, charitable or other duties. The Contractor shall not recruit on SEC premises or otherwise act to disrupt official SEC business. The Contractor shall be responsible when its employees are on site at the SEC for maintaining satisfactory standards of employee competency, conduct, appearance, and integrity, and shall be responsible for taking such disciplinary action with respect to its employees as may be necessary. Contractor employees are expected to adhere to standards of conduct that reflect credit on themselves, their employer, the SEC and the Federal Government.

6012.00 Security and Privacy Act Matters (Mar 2009)

The security classification for work performed under this contract is Public Trust. The documents that shall be reviewed and produced are non-public and sensitive in nature and shall be protected from unauthorized disclosure. Work on this project request that personnel have access to Privacy Act Information. Personnel shall adhere to the Privacy Act, Title 5 of the U.S. Code, Section 552a and applicable agency rules and regulations.

6012.01 Compliance with Security Regulations, Policies, and Procedures (Mar 2012)

The Contractor shall be responsible for compliance by its employees with SEC security regulations, policies, and procedures. This includes safekeeping, wearing, and visibility of identification badges. The SEC will issue Contractor identification badges to on-site Contractor personnel, and the badges shall be visible at all times while employees are on SEC premises. The Contractor shall provide all requested information (the SEC will provide forms to the Contractor at time of award) required to facilitate issuance of identification badges and shall conform to applicable regulations concerning the use and possession of the badges. The Contractor shall be responsible for ensuring that all identification badges issued to the Contractor employees are returned within forty-eight (48) hours following the completion of the contract, relocation, or termination of an employee and/or request of the Contracting Officer or the Contracting Officer’s Representative (COR).

6012.02 SEC 508 Requirements (March 2011)

Pursuant to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce Investment Act of 1998, all electronic and information technology (EIT) products and services developed, acquired, maintained, and/or used under this contract/order must comply with the Electronic and Information Technology Accessibility Provisions set forth by the Architectural and Transportation Barriers Compliance Board (also referred to as the ‘Access Board’) in FAR 39.2.The complete text of Section 508 Final Provisions can be accessed at http://www.access-board.gov/sec508/provisions.htm.

All EIT products must comply with the following standards. Descriptions of the standards are viewable at the link Section 508 Standards.

Offerors that fail to demonstrate compliance with the above standards, or provide equivalent salient characteristics, may be eliminated from further consideration for award.

The Contractor shall indicate for each line item in the schedule whether each product or service is compliant or non-compliant with the accessibility standards at 36 CFR 1194 using a Voluntary Product Accessibility Template (VPAT). Further, the quote must indicate where full details of compliance can be found (e.g., vendor’s website or other exact location). The offeror further represents that all EIT products and services that are less than fully compliant have been reviewed and plans to correct are in place.

Respondents to this solicitation must provide any additional detailed information necessary for determining applicable Section 508 standards conformance, as well as for documenting EIT products and/or services that are incidental to the project, which would constitute an exception to Section 508 requirements. If a vendor claims its products and/or services, including EIT deliverables such as electronic documents and reports, meet applicable Section 508 standards, and it is later determined by the Government ‘ i.e., after award of a contract/order, that products and/or services delivered do not conform to the described accessibility, remediation of the products and/or services to the level of conformance specified in the contract will be the responsibility of the Contractor at its expense.

(End of Provision)

6012.02 Electronic and Information Technology (Mar 2009)

In accordance with Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), all EIT supplies or services provided under this contract must comply with the applicable accessibility standards issued by the Architectural and Transportation Barriers Compliance Board at 36 CFR Part 1194 (see FAR Subpart 39.2). Electronic and information technology (EIT) is defined at FAR 2.101.

6012.04 Electronic and Information Technology Accessibility (Mar 2011)

Each Electronic and Information Technology (EIT) product or service furnished under this contract shall comply with the Electronic and Information Technology Accessibility Standards (36 CFR 1194 ). If the Contracting Officer determines any furnished product or service is not in compliance with the contract, the Contracting Officer will promptly inform the Contractor in writing. The Contractor shall, without charge to the Government, repair or replace the non-compliant products or services within the period of time to be specified by the Government in writing. If such repair or replacement is not completed within the time specified, the Government shall have the following recourses:

The right to Termination of the contract, delivery or task order, purchase or line item without termination liabilities pursuant to the contract termination clauses; or In the case of custom Electronic and Information Technology (EIT) being developed for the Government, the Government shall have the right to have any necessary changes made or repairs performed by itself or by another firm and the contractor shall reimburse the Government for any expenses incurred thereby.

For every EIT product or service accepted under this contract by the Government that does not comply with 36 CFR 1194, the contractor shall, at the discretion of the Government, make every effort to replace or upgrade it with a compliant equivalent product or service, if commercially available and cost neutral, on either the planned refresh cycle of the product or service, or on the contract renewal date, whichever shall occur first.

In the event of a modification(s) to this contract/order, which adds new EIT products and services or revises the type of, or specifications for, products and services the Contractor is to provide, including EIT deliverables such as electronic documents and reports, the Contracting Officer may require that the contractor provide an update of information provided in the solicitation to identify EIT compliance. Under any maintenance agreement, Contractor agrees to maintain compliance with Section 508 of the Rehabilitation Act of 1973 for all EIT.

In order to comply with 36 CFR 1194 Section 41, the Contractor shall submit all soft copies (e.g., user manuals, product documentation, etc.) in a format that will be readable using assistive technology, (e.g., screen reader). All imbedded charts, graphs, pictures, etc., must be accessible and understandable using a screen reader.

(End of Clause)

6012.05 Personally Identifiable Information (PII) (Jun 2013)

A Contractor that designs, develops, or operates a system of records on individuals, or otherwise collects or has access to personally identifiable information (PII) in the performance of this contract shall, prior to taking such action, comply with the following requirements:

(a) The Contractor shall have established policies and procedures in place to safeguard SEC PII. The policies and procedures shall provide the Contractor’s processes for identifying, assessing and mitigating privacy risks associated with PII. The policies and procedures shall also cover training of employees on their roles and responsibilities for safeguarding SEC PII and incident management of suspected or confirmed loss of SEC PII in accordance with OMB’s Recommendations for Identity Theft Related Data Breach Notification, September 20, 2006, and OMB Memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, May 22, 2007.

(b) The Contractor shall also ensure that all processes, procedures and equipment associated with PII comply with all laws, regulations, and security mandates as defined by National Institute of Standards and Technology (NIST) Special Publication (SP) 800-61 Revision 1 and are aligned with the incident categories and timelines referenced in Table J-1 of NIST SP 800-61, as well as U.S. government and SEC policies developed to safeguard the confidentially, integrity and availability of SEC data that may contain PII. In support of these requirements, the Contractor shall have:

(c) The Contractor shall provide quarterly assessments to the SEC demonstrating that the policies, procedures, and mechanisms required by (b) continue to be functional, that the Contractor is compliant with these requirements, and that these requirements are effective.

(d) The Contractor shall provide a copy of its privacy policies to the Contracting Officer. The Contractor shall also provide a copy of the policies and procedures (or otherwise make such policies and procedures available) to all of its employees, agents, and subcontractors assigned to perform the requirements set forth in this contract.

(e) The Contractor shall ensure that those individuals adhere to the Contractor’s policies and procedures relating to PII and to SEC-prescribed policies and procedures for the safe handling of SEC PII, including privacy and security training requirements and privacy incident management.

(f) The Contractor’s employees, agents, and subcontractors shall immediately alert the SEC of any event, including the suspected or confirmed loss of SEC PII, that could potentially affect the privacy rights of individuals or which violates any federal law, regulation, mandate or requirement as defined in NIST 800-122 by contacting the SEC Information Systems Security point of contact and the SEC Incident Response Team at cops@sec.gov. The Contractor shall act in accordance with its policies and procedures in the event of any suspected loss of SEC PII and shall support the SEC’s investigation and resolution of reported incidents as requested by the SEC. For purposes of this Clause, a ‘suspected loss of PII’ shall be interpreted liberally to mean any situation in which the loss of PII or unapproved access to PII is deemed a reasonable possibility.

6013.00 Common Security Configurations (Mar 2009)

Common security configurations are published on NIST’s web site http://checklists.nist.gov. NIST’s Computer Security Division website is located at http://csrc.nist.gov. For more information about the security content automation program, see http://nvd.nist.gov/scap.cfm. NIST Special Publication 800-70, ‘Security Configuration Checklist Program for IT Products,’ is located at http://csrc.nist.gov/checklists/SP800-70-DRAFT.pdf.

6014.00 Use of Contractor Data and/or Materials (Mar 2009)

The Contractor acknowledges and agrees to the following: The SEC anticipates using the data and/or materials to conduct analyses for use in reports, studies, memoranda, and presentations. The SEC anticipates the following types of situation where analyses based on underlying data may be made public: by the SEC itself (E.g., SEC rulemaking and/or analysis done as part of an inspection or enforcement action), by SEC staff where the SEC is directing or facilitating the publication (e.g., a staff study in response to a Congressional request), by SEC staff facilitating their own private publication where the Commission has not taken a position regarding the publication of the analysis(e.g., a research report to be submitted by the individual staff to an academic conference or journal), and a former employee of the SEC who has substantially completed the analysis while on staff and is facilitating his/her own private publication( e.g., a research report to be submitted to an academic conference or journal). In all of these situations, only ‘insubstantial amounts’ of the licensed data and/or material would be made public and no raw data would be made public, the authors would agree to abide by all contractual terms and conditions, and as the owner/licensor of the data the Contractor would receive attribution and be cited as the data source. ‘Insubstantial amounts’ means an amount that has no independent commercial value and could not be used as a substitute for the service or product or any part of it.

6015.00 SEC On-Site Contractors (Feb 2012)

Space, desk, phone and computer will be made available to on-site contractor personnel at the SEC for use in the performance of their task and will be returned when they are no longer on-site.

6016.00 Supplies (Jan 2013, Revised May 2, 2013)

The Contractor shall provide all supplies to support the requirements of this award. The SEC will not provide supplies used in the normal daily performance of work such as note paper, pens, calendars, staplers, etc. If there is a need for specific supplies required by the performance of the work, the Contractor's Program Manager shall notify the Contracting Officer's Representative (COR).

6017.00 Communicating Non-public or Sensitive Information (May 2013)

When communicating "Non-public or Sensitive information" via email, during the period of this contract, the Contractor shall submit all such communications using Zixmail. ZixMail encrypts outgoing messages, decrypts and validates incoming messages, and authenticates both the sender's and recipient's e-mail identities. The Contractor shall use the following instructions for using Zixmail:*

Login at U.S. Securities and Exchange Commission Secure Email Password Authorization View message under the "Inbox" tab or create and send new messages from the "Compose" tab.

*Notes: "The Contractor must register a new account first at U.S. Securities and Exchange Commission Secure Email Password Authorization prior to reading or sending encrypted messages. The Contractor will be provided with a link to create an account the first time you send them an encrypted message. This link will also be used by the Contractor subsequently to read and compose messages. The Contractor can only send encrypted e-mail messages from the ZixMail portal to SEC employees. All e-mail contents, including attachments, are encrypted when sent using this method."

Attachments.

1 – Non Disclosure Agreement (contractor) 2 – Non Disclosure Agreement (employee)